Diving into Windows Remote Access Service for Pre-Auth Bugs
summary
Finds dozens of pre-auth crashes by combining multi-threaded fuzzers with manual reverse engineering, then confirms root causes: use-after-free, null dereference, integer overflow, heap OOB and buffer overflow across PPTP, SSTP, L2TP and IKE. Demonstrates a reproducible UAF in every Windows VPN protocol tested, turns up high-value DoS and info‑leak cases worth $30,000 DoS payouts and targets qualifying for the $100,000 pre-auth RCE award, and triggers Microsoft to change RAS bounty scoping.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:00PPP
- 13:09Authentication protocols
- 14:42Network Policy Server
- 17:11STP
- 22:53User Mode
- 25:16L2TP
- 31:32IKE
- 37:09Summary
related talks
39mFuzzing and Exploiting Virtual Channels in Microsoft Remote Desktop Protocol for Fun and Profit
46mInfiltrating Corporate Intranet Like NSA - Pre-auth RCE on Leading SSL VPNs
29mLike Lightning From the Cloud: Finding RCEs in an Embedded TLS Library
27mWIFI-Important Remote Attack Surface: Threat is Expanding
39mSeasCoASA: Exploiting A Small Leak In A Great Ship
32m802.1x and Beyond!
50mPwnie Awards 2016
45mThe Code Behind The Vulnerability